phpMyAdmin Variables Overwrite Vulnerability

2005-12-07 / 2005-12-08
Credit: Stefan Esser
Risk: High
Local: No
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: phpMyAdmin Variable Overwrite Vulnerability Release Date: 2005/12/07 Last Modified: 2005/12/07 Author: Stefan Esser [sesser (at) hardened-php (dot) net [email concealed]] Application: phpMyAdmin 2.7.0(-rc1) Severity: A flaw in the variable overwrite protection may lead to several XSS and local and remote file inclusion vulnerabilities Risk: Critical Vendor Status: Vendor has released an updated version References: http://www.hardened-php.net/advisory_252005.110.html Overview: Quote from www.phpmyadmin.net: "phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the Web. Currently it can create and drop databases, create/drop/alter tables, delete/edit/add fields, execute any SQL statement, manage keys on fields, manage privileges,export data into various formats and is available in 50 languages." A quick audit of the variable overwrite protection that was redesigned for phpMyAdmin 2.7.0 revealed an easy to exploit flaw, that leads to total failure of the protection and therefore opens phpMyAdmin to a number of XSS, local and remote file inclusion vulnerabilities. Details: phpMyAdmin comes with a register_globals emulation layer within grab_globals.php, to ensure compatibility with hosts where this feature is turned off. This layer was heavily modified for the release of phpMyAdmin 2.7.0. One of the major changes is, that the blacklist of variables that may not be overwritten by the emulation layer is now stored in a global variable. Unfortunately the variablename $import_blacklist is not covered by the protection and therefore it was possible for an attacker to overwrite the blacklist. After the blacklist is overwritten an attacker can f.e. overwrite the $GLOBALS array with arbitrary content and therefore exploit several places where the $GLOBALS array is used. During normal execution this $GLOBALS array is just another way to access global variables, but when a script overwrites it, it becomes a normal variable, with a few exceptions in PHP4. For more information about what unexpected things can happen when $GLOBALS is overwritten please have a look at http://www.hardened-php.net/globals-problem In phpMyAdmin $GLOBALS is used f.e. in the CSS generator to access the global variable that stores the configuration. Due to the fact, that the content of this variable is under total control of the attacker the path to an included file can be injected. This leads to an remote URL include vulnerability in PHP5 and a local file include vulnerability in PHP4. The difference is caused by the fact, that the PHP function file_exists() does not work on URL wrappers within PHP4, but works on ftp:// URLs in PHP5. (When the host is running our Hardening-Patch for PHP such a remote URL inclusion is of course not allowed and logged). Please also note that there are multiple (easy) ways to get PHP code into files on the server, so that local file inclusion vulnerabilities are more dangerous than they seem. Additionally it is possible to directly include PEAR.php from the installed PHP distribution. If it is one that was shipped with PHP <= 4.3.10 this can be used to directly execute code on the server by manipulating the destructor list. There are other places in phpMyAdmin, where this vulnerability can lead to XSS and other local file inclusion vulnerabilities. Those will not be listed separately, because the problem mentioned above is already serious enough to demonstrate the impact of the failing overwrite protection. Proof of Concept: The Hardened-PHP project is not going to release exploits for this vulnerability to the public. Disclosure Timeline: 6. December 2005 - Disclosed vulnerability to vendor 7. December 2005 - Release of new phpMyAdmin version 7. December 2005 - Public Disclosure Recommendation: It is strongly recommended to upgrade to the new version of phpMyAdmin which you can download at: http://www.phpmyadmin.net/home_page/downloads.php GPG-Key: http://www.hardened-php.net/hardened-php-signature-key.asc pub 1024D/0A864AA1 2004-04-17 Hardened-PHP Signature Key Key fingerprint = 066F A6D0 E57E 9936 9082 7E52 4439 14CC 0A86 4AA1 Copyright 2005 Stefan Esser. All rights reserved. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQFDlrwQRDkUzAqGSqERAmRXAJ91rK7yBmaD11xKZYT/3AQssLcx1ACdEmxV ikwFLy/0HqQmcWp98DVzCVk= =BCKL -----END PGP SIGNATURE-----


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top